fix: Resolve Bun scoped package deps that share a name with a dependency by anthonyshew · Pull Request #13207 · vercel/turborepo

anthonyshew · 2026-07-02T20:30:47Z

Why

turbo prune --docker produced a bun.lock that failed bun install --frozen-lockfile when a workspace depended on a scoped package whose unscoped name matches one of its own dependencies (e.g. @types/webpack depends on webpack). The dependency and its entire transitive subtree were silently dropped from the pruned lockfile, breaking Docker builds.

Fixes #13204

What

Fix the nested-dependency parent-chain walk in the Bun lockfile resolver to understand scoped package names.
Add a unit test covering the @types/webpack -> webpack case.
Add the issue reproduction as a check-lockfiles fixture (bun-v1-issue-13204).

How

nested_dependency_entry walked up an entry's parent chain by splitting the lockfile key on every /. For a top-level scoped key like @types/webpack, it treated @types as a parent, looked up @types + /webpack, and found the @types/webpack entry itself. The webpack dependency was then pinned to =5.28.5 (@types/webpack's own version), which resolves to nothing, so webpack fell out of the transitive closure.

The walk now uses PackageKey::parse(...).parent(), which already handles scope separators, so a top-level scoped entry has no parent and the bogus self-match can't happen.

To verify: run the repro from the issue against a build of this branch, or pnpm check-lockfiles --fixture bun-v1-issue-13204 in lockfile-tests/. Both prune targets pass bun install --frozen-lockfile; all 62 other bun fixture cases still pass.

▲ Created with Vercel devbox

The nested-dependency parent-chain walk split lockfile keys on every slash, so a top-level scoped key like @types/webpack was treated as a nested entry (parent @types, child webpack). When a scoped package depended on a package matching its unscoped name (@types/webpack -> webpack), the walk resolved the dependency to the scoped package itself, pinning it to the wrong version and dropping it from pruned lockfiles. Walk the parent chain with PackageKey, which understands scoped names. Fixes #13204 ▲ Created with [Vercel devbox](https://vercel.com/vercel/~/sandboxes/devboxes/1vqtafqp4trmfrfp36wje43qb0oy)

vercel · 2026-07-02T20:30:54Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
examples-basic-web	Ready	Preview, Comment, Open in v0	Jul 2, 2026 8:31pm
examples-designsystem-docs	Ready	Preview, Comment, Open in v0	Jul 2, 2026 8:31pm
examples-gatsby-web	Ready	Preview, Comment, Open in v0	Jul 2, 2026 8:31pm
examples-kitchensink-blog	Ready	Preview, Comment, Open in v0	Jul 2, 2026 8:31pm
examples-nonmonorepo	Ready	Preview, Comment, Open in v0	Jul 2, 2026 8:31pm
examples-svelte-web	Ready	Preview, Comment, Open in v0	Jul 2, 2026 8:31pm
examples-tailwind-web	Ready	Preview, Comment, Open in v0	Jul 2, 2026 8:31pm
examples-vite-web	Ready	Preview, Comment, Open in v0	Jul 2, 2026 8:31pm
turbo-site	Ready	Preview, Comment, Open in v0	Jul 2, 2026 8:31pm

## Release v2.10.3 > [!CAUTION] > Versioned docs aliasing FAILED. [View logs](https://github.com/vercel/turborepo/actions/runs/28672736782) ### Changes - feat: Add nub to create-turbo options (#13173) (`82b1cf1`) - release(turborepo): 2.10.2 (#13174) (`ec30b18`) - release(turborepo): 2.10.3-canary.1 (#13176) (`47e2b22`) - fix: Normalize package manager versions (#13177) (`658f607`) - fix: Use singular workspace in package resolution error (#13178) (`d199c53`) - fix: Support nub native lockfiles (#13179) (`50546e6`) - perf(build): Enable thin LTO + codegen-units=1 for release builds (#13160) (`628aea9`) - release(turborepo): 2.10.3-canary.2 (#13181) (`16aed08`) - feat: Add aube package manager support (#13183) (`0f78006`) - release(turborepo): 2.10.3-canary.3 (#13184) (`fec7cee`) - fix: Normalize package manager version output (#13185) (`f469ed8`) - release(turborepo): 2.10.3-canary.4 (#13186) (`406fe59`) - refactor: Richer internal dependency data (#13188) (`909c696`) - fix: Honor package manager version ranges (`136273e`) - fix: Skip node_modules in boundaries checks (#13191) (`93741a0`) - fix: Add token exchange recovery guidance (#13192) (`bef588b`) - feat: Add --production flag to turbo prune (#13190) (`3777442`) - release(turborepo): 2.10.3-canary.5 (#13193) (`ca20ca2`) - feat: Accept Bun lockfile version 2 (#13119) (`69e2085`) - fix: Handle task executor join errors as internal errors (#13148) (`c4017e9`) - fix: Tweaks for nub support (#13187) (`ca029ee`) - release(turborepo): 2.10.3-canary.6 (#13194) (`b79f767`) - release(turborepo): 2.10.3-canary.7 (#13195) (`b426736`) - chore: Upgrade TypeScript to 7.0.1-rc (#13144) (`cf07baa`) - docs: Add filtered installs to Vercel guide (#13196) (`7e70b52`) - examples: add with-mcp-servers (#12997) (`8eb4d9d`) - fix: Report malformed JSON parse errors instead of panicking (#13198) (`a69df7d`) - fix: Improve error messaging when platform binary is missing (#13199) (`8e145f0`) - release(turborepo): 2.10.3-canary.8 (#13200) (`5987ed1`) - fix(watch): recover from slow initial hash instead of timing out (#13159) (`05e26cb`) - chore: Update vitest example to vitest 4 and use native test merging (#13202) (`e2b61dc`) - feat: Toggle between the TUI and streamed logs (#13203) (`1325455`) - fix: Resolve Bun scoped package deps that share a name with a dependency (#13207) (`e4773ab`) - feat: Select tasks by clicking rows in the TUI task list (#13206) (`c568f67`) - perf: Avoid deep-cloning dependency maps in lockfile closure cache (#13209) (`abd84cf`) - perf: Cache root internal dependencies in package graph (#13211) (`7ec8c6d`) - feat: Automatically copy TUI selection to clipboard on mouse release (#13208) (`61d6013`) - perf: Cache env wildcard matches across tasks during hashing (#13210) (`148b1dd`) - perf: Replace per-package graph traversals in scope filtering (#13212) (`28d1871`) - perf: Derive dirty hash from repo index (#13213) (`b521d32`) - fix: Include untracked symlinks in repo-index dirty hash (#13218) (`c3c91ab`) - refactor: Use upstream libghostty-vt crates instead of vendored bindings (#13205) (`c2115dc`) - fix: Remove devtools feature flag (#13219) (`65efe27`) - fix: Harden TUI terminal restore during shutdown (#13220) (`dccab93`) - fix: Correct gitignore precedence in untracked walk and memoize matcher chains (#13221) (`bc32fcc`) --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

## Release v2.10.4-canary.1 > [!CAUTION] > Versioned docs aliasing FAILED. [View logs](https://github.com/vercel/turborepo/actions/runs/28719728846) ### Changes - release(turborepo): 2.10.3-canary.8 (#13200) (`5987ed1`) - fix(watch): recover from slow initial hash instead of timing out (#13159) (`05e26cb`) - chore: Update vitest example to vitest 4 and use native test merging (#13202) (`e2b61dc`) - feat: Toggle between the TUI and streamed logs (#13203) (`1325455`) - fix: Resolve Bun scoped package deps that share a name with a dependency (#13207) (`e4773ab`) - feat: Select tasks by clicking rows in the TUI task list (#13206) (`c568f67`) - perf: Avoid deep-cloning dependency maps in lockfile closure cache (#13209) (`abd84cf`) - perf: Cache root internal dependencies in package graph (#13211) (`7ec8c6d`) - feat: Automatically copy TUI selection to clipboard on mouse release (#13208) (`61d6013`) - perf: Cache env wildcard matches across tasks during hashing (#13210) (`148b1dd`) - perf: Replace per-package graph traversals in scope filtering (#13212) (`28d1871`) - perf: Derive dirty hash from repo index (#13213) (`b521d32`) - fix: Include untracked symlinks in repo-index dirty hash (#13218) (`c3c91ab`) - refactor: Use upstream libghostty-vt crates instead of vendored bindings (#13205) (`c2115dc`) - fix: Remove devtools feature flag (#13219) (`65efe27`) - fix: Harden TUI terminal restore during shutdown (#13220) (`dccab93`) - fix: Correct gitignore precedence in untracked walk and memoize matcher chains (#13221) (`bc32fcc`) - release(turborepo): 2.10.3 (#13222) (`02f4ed0`) - ci: Retry Windows nextest aborts from transient 0xc0000142 spawn failures (#13240) (`222ffff`) - perf: Use mimalloc as the global allocator (#13237) (`c42a8a9`) - perf: Parse yarn v1 lockfiles in a single pass (#13241) (`6207099`) - ci: Fix cache outputs for Eve app (#13243) (`d8b556d`) - perf: Stop materializing spans for the disabled daemon log layer (#13244) (`623aadc`) - fix: Keep ancestor-scoped bun dependencies resolvable after prune renames (#13236) (`8658b66`) - perf: Overlap external dependency hashing with package file hashing (#13234) (`445b0c7`) - perf: Build tracked repo index concurrently with package graph (#13232) (`f4699c6`) - perf: Release tokio runtime at exit so background DNS lookups never stall the user (#13231) (`ae635bd`) - perf: Overhaul pnpm lockfile parsing and dependency closure computation (#13228) (`669676d`) - feat: Add futureFlags.experimentalCargoWorkspaces flag (no-op) (#13227) (`f546930`) - feat: Introduce toolchain provider abstraction (#13235) (`f03addb`) - perf: Parse Berry lockfiles in a single pass (#13242) (`6d36125`) - fix: Apply input exclusion globs to the filesystem walk (#13224) (`d3f9dd3`) - fix: Stop root-directory packages from claiming every file in change mapping (#13225) (`f80203a`) - chore: Rename turborepo-repository napi package to @turbo/repository (#13226) (`c1972b3`) - perf: Hash git blobs with hardware-accelerated SHA-1 (#13245) (`17ffa0c`) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

anthonyshew requested a review from a team as a code owner July 2, 2026 20:30

anthonyshew requested review from tknickman and removed request for a team July 2, 2026 20:30

anthonyshew added devbox and removed devbox labels Jul 2, 2026

anthonyshew enabled auto-merge (squash) July 2, 2026 20:48

tknickman approved these changes Jul 2, 2026

View reviewed changes

anthonyshew merged commit e4773ab into main Jul 2, 2026
41 of 42 checks passed

anthonyshew deleted the shew/fix-bun-scoped-nested-walk branch July 2, 2026 21:08

github-actions Bot mentioned this pull request Jul 3, 2026

release(turborepo): 2.10.3 #13222

Merged

github-actions Bot mentioned this pull request Jul 4, 2026

release(turborepo): 2.10.4-canary.1 #13247

Merged

Sh1v4nk mentioned this pull request Sep 12, 2026

turbo prune --docker emits invalid bun.lock (flattened keys + ghost stanzas) #14048

Closed

1 task

Navigation Menu

fix: Resolve Bun scoped package deps that share a name with a dependency - #13207

fix: Resolve Bun scoped package deps that share a name with a dependency#13207
anthonyshew merged 1 commit into
mainfrom
shew/fix-bun-scoped-nested-walk

anthonyshew commented Jul 2, 2026

Uh oh!

vercel Bot commented Jul 2, 2026 •

edited

Loading

Uh oh!

Uh oh!

This branch had an error being deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

anthonyshew commented Jul 2, 2026

Why

What

How

Uh oh!

vercel Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

This branch had an error being deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vercel Bot commented Jul 2, 2026 •

edited

Loading